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I . INTRODUCTION* 


This study considers the design of a sensor fault tolerant 
system using analytic redundancy for the TCV (Terminal Configured 
Vehicle) research aircraft (Boeing 737) in a Microwave Landing 
System (MLS) environment. The overall objective of the fault 
tolerant system is to provide reliable estimates for aircraft 
position, velocity, and attitude in the presence of possible 
failures in navigation aid instruments and on-board sensors. The 
estimates, provided by the fault tolerant system, are used by the 
automated guidance and control system to land the aircraft along a 
prescribed path. Sensor failures are identified by utilizing the 
analytic relationship between the various sensor outputs arising 
from the aircraft equations of motion. 

An aircraft sensor fault tolerant system design methodology is 
developed by formulating the problem in the context of simultaneous 
state estimation and failure identification in discrete time 
nonlinear stochastic systems. The resulting sensor fault tolerant 
system consists of 1) a no-fail estimator which is an extended 
Kalman filter (EKF) based on the assumption of no failures and 

* Use of commercial products or names of manufacturers in this 
report does not constitute official endorsement of such products 
or manufacturers, either expressed or implied, by the National 
Aeronautics and Space Administration. 
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provides estimates for aircraft state variables and normal 
operating sensor biases; 2) a bank of detectors which are first 
order filters for estimating bias jump failures in sensor outputs; 
3) likelihood ratio computers; and 4) a decision function which 
selects the most likely failure mode based on the likelihood 
ratios. 

The operation of the fault tolerant system is as follows: 
First, the EKF computes estimates for aircraft position, velocity, 
attitude, horizontal winds, and normal operating sensor biases on 
the assumption of no sensor failures. The residuals of this EKF 
drive a bank of detectors each of which estimates a postulated bias 
jump failure for a given sensor. Then, multiple hypothesis testing 
procedure is employed to decide whether the EKF is operating with 
healthy sensors or under one of the hypothesized failed sensor 
modes. The multiple hypothesis test selects the most likely 
failure mode based on the likelihood ratios which are computed 
using the bias jump failure estimates from the detectors. When a 
failure is declared by the decision logic, the filter-detector 
structure is reconfigured by throwing out the failed sensor, making 
the appropriate changes in the no-fail filter and detectors, and 
initializing the likelihood ratios and a priori probabilities. 

The no-fail filter is implemented in a rectangular coordinate 
system with origin on the runway by using a new separate bias EKF 
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algorithm which has been obtained by extending the known results 
for the linear case to nonlinear systems. The body mounted 
accelerometers and rate gyros form the inputs into the EKF, while 
MLS range, azimuth, elevation measurements, IAS (indicated 
airspeed), and IMU (inertial measurement unit) attitude outputs are 
utilized as measurements by the EKF. If an RSDIMU (dual 
fail-operational two-degree-of-f reedom strapdown inertial 
measurement unit) is used instead of the IMU, then the RSDIMU 
accelerometers and rate gyros replace the body mounted 
accelerometers and rate gyros and the RSDIMU attitude outputs 
replace the IMU Euler angle measurements. The function of the 
no-fail filter is similar to that of a navigator coordinatized in a 
local runway frame of reference. While the navigator equations 
usually involve open loop integration of the body accelerations in 
the runway frame with occasional position and velocity fixes, the 
no-fail EKF in our study performs the position, velocity, and 
attitude updates on-line in a closed loop feedback system 
mechanism. 

The proposed filter-detector structure is computationally 
feasible. In contrast to a previous study reported in [22]-[23], 
where the failure detection system requires the implementation of 
M+1 high order nonlinear EKF's (where M is the total number of 

possible sensor failures) , the proposed sensor fault tolerant 
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system design requires a single high order EKF (no-fail filter) and 
M first order detectors. The state estimation and failure 
detection performance of the developed sensor fault tolerant system 
is analyzed by using a nonlinear six-degree-of-freedom simulation 
of the TCV research aircraft. 

The simulation software is essentially an integration of the 
NASA supplied TCV and RSDIMU computer simulation programs. 
Aircraft sensor models have been developed and appended into the 
simulation to provide more realistic normal operating errors. 
Furthermore, sensor failure models for increased bias, hardover, 
null, scale factor, ramp, and Increased noise type sensor 
malfunctions have also been assimilated into the software. 

Preliminary analysis of the simulation results obtained so far 
indicates that the no-fail EKF estimation errors compare favorably 
to those obtained with other types of navigation filters employed 
in the same MLS environment. Sensor failure detection performance 
of the fault tolerant system is excellent for the EKF output 
sensors such as MLS, IAS, IMU measurements, while the failure 
detection speed for input sensors such as accelerometers and rate 
gyros has been found to be slower than that of output sensors. A 
number of technical issues have been identified during the course 
of the study and will be further investigated for possible 
improvement of failure detection performance. 
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The organization of the report is as follows; Chapter 2 
describes the development of the proposed aircraft fault tolerant 
system. Simulation-related work is given in Chapter 3. A 
discussion of the simulation results is provided in Chapter 4. 
Chapter 5 contains a summary of the work done along with an outline 
of issues to be resolved in the second year of the study. 
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II. FILTER-DETECTOR DEVELOPMENT 


In this chapter the analytical structure for an aircraft 
sensor fault tolerant navigation system will be developed. The 
resulting system will be shown to consist of a failure-free 
conditioned (navigation) filter followed by a bank of low-order 
failure detectors and their companion decision logic. Although the 
original formulation outlined in our proposal was based on using a 
linear time-varying model of the aircraft dynamics, it was decided 
to extend the utility of the resulting system by employing a 
detector— estimator structure based on nonlinear aircraft point mass 
equations of motion. This decision necessitated the development of 
nonlinear filter-detector algorithms analogous to those given in 
the proposal for the linear case. While the new algorithms are 
naturally more complex due to the linearizations involved in 
nonlinear filtering, they have the advantage of being independent 
of the flight path and the selected trim condition. 

The outline of Chapter II is as follows. An overall 
description of the fault-tolerant system is given in Section 2.1. 
The aircraft point mass equations of motion and sensor dynamics, on 
which the filter-detector development is based, is then discussed 
in Section 2.2. Section 2.3 outlines the operation of the no-fail 
filter. Failure detector implementation is discussed in Section 
2.4, and in Section 2.5, the operation of the failure decision 
logic is explained. 
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2.1 Fault Tolerant System Overview 


The design problem, in its most generic form, can be stated as 
follows: Given discrete, redundant measurements of the various 

on-board sensors and navigation aid instruments on an aircraft, 
generate estimates for the vehicle states required by the automated 
guidance and control laws such that reliable estimates are produced 
in the presence of possible sensor failures. The desired qualities 
of a fault tolerant system accomplishing these requirements are the 
following : 

- fast detection of different types of failures (i.e, 

hardover, null, increased inaccuracy, ramp, etc.) 

- ability to handle various levels of failures for a given 

sensor (i.e., hard, mid and soft) 

- utilize inherent analytical redundancy 

- minimal complexity 

With these goals in mind, the aircraft sensor fault detection 
design problem was formulated in the context of simultaneous state 
estimation and failure detection in nonlinear discrete time 
stochastic systems. Figure 1 displays the major components of the 
resulting filter-detector structure. 
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REPLICATED AIRCRAFT SENSOR MEASUREMENTS 



Figure 1. Filter- Detector Structure 
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As seen in the figure, our filter-detector structure consists 
of 1) a no-fail estimator which is an extended Kalman (EKF) filter 
based on the assumption of no failures and provides estimates for 
A/C state variables and normal operating sensor biases; 2) a bank 
of detectors which are first order filters for estimating bias jump 
failures in sensor outputs; 3) likelihood ratio computers; and 4) a 
decision function which selects the most likely failure mode in the 
Bayesian sense based on the likelihood ratios. Each of these major 
components will be discussed in detail in the ensuing sections. In 
this section, only aa ovecaLL picture ot the operation of the 
system is discussed. 

Notice that only one set of the replicated input sensors and 
the average of the replicated output sensors enter into the no-fail 
filter after getting processed in the "selection logic" and "summer 
logic" blocks. The use of these lower order "generic" inputs and 
observations serves to reduce the overall complexity of the no-fail 
filter, without a corresponding loss of generality. The no-fail 
filter functions essentially as a navigator in this system, 
estimating the state of the aircraft and the "normal operating" 
biases on input sensors. However, unlike most navigators, this one 
continuously filters the navigation aid, IAS, and attitude 
measurements, so as to constantly correct the propagated state 
estimates. In addition, it is formulated as a nonlinear extended 
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Kalman filter so that it is independent of flight path and trim 
conditions. 

Following the no-fail filter in Figure 1 is a functional block 
which forms an expanded set of residuals (essentially undoing the 
effects of driving the no-fail filter with averaged measurements) . 
These residuals, in turn, drive a bank of detectors, where each 
detector is cascaded by a likelihood ratio computer. Currently, 
each detector is designed to identify a single sensor failure, and 
compensate the no-fail residuals so as to approximately remove the 
effects of the hypothesized sensor failure. The detectors are 
essentially first order Kalman filters each of which estimate a 
hypothesized bias jump for a given sensor. This simple bias 
failure model was chosen because it is fairly robust in detecting 
many other types of failures [24] . 

Each likelihood ratio computer takes in a residual sequence 
from the no-fail filter or the detectors, and returns a likelihood 
ratio which reflects the a posteriori probability of that residual 
sequence corresponding to the true hypothesis. Likelihood ratios 
from all the likelihood ratio computers then drive a decision 
module. Here a Bayes cost function is minimized and the most 
probable hypothesis along with its failure level estimate and 
posteriori probability is passed to the filter-detector 
reconfiguration logic. Depending on the magnitude of the failure 
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level estimate and the confidence in the selected decision as 
dictated by its a posteriori probability, the reconfiguration logic 
either waits for further failure confirmation or deletes the failed 
sensor, appropriately modifies the filter-detector structure, and 
initializes the likelihood ratio computers. 

2.2 Aircraft Equations of Motion 

The estimator -detector algorithms will be developed using 
aircraft point mass equations of motion mechanized in a ground 
based, flat earth Cartesiaa coordinate system (G frame) with its 
origin located on the runway (See Figure 2) . For ease of 
presentation, it will be assumed that the G-frame is inertial. 
Since the aircraft position, velocity, and attitude are needed by 
the automated guidance and control system to land the aircraft 
along a prescribed path, these variables along with horizontal wind 
components will be selected as state variables for estimation. 

The sensor package considered here includes three body mounted 
accelerometers, each one aligned along one of the body frame axis 
[3] , a similar set of three body mounted rate gyros, along with an 
airspeed indicator, and an IMU platform or a RSDIMU. Only the 
algorithms for the sensor package containing the IMU will be 
presented. The navigation aid is a ground-based Microwave Landing 
System (MLS) which transmits position information to aircraft 
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within its volumetric coverage at discrete time intervals. The MLS 
consists of a Distance Measuring Equipment (DME) providing aircraft 
range information, an azimuth antenna co-located with the DME 
provides the aircraft's angle relative to the runway, and an 
elevation antenna, located near the glidepath intercept point 
provides the aircraft with its elevation angle relative to the 
local horizon. 

Body mounted accelerometers and rate gyro measurements form 
the inputs into the dynamics, while MLS, IMU and IAS comprise the 
system dynamics outputs. In the following, unsubscripted variables 
will imply coordinatization in the G-frame. The aircraft state 
will be given by x= [r^^, r^, r^, f f jzJ,0, ,w^,Wy] ' where 
(r ,r ,r ) and (f„,f„,f_) are the A/C position and velocity with 
respect to the runway frame, (^,0,4') are the vehicle Euler angles 
[4] , and (w^^rWy) are the horizontal wind components. Transforming 
the specific force [3] measured by the body mounted accelerometers 
into the G-frame, and integrating this expression along with the 
differential equations for the Euler angles over a sampling 
interval of t seconds [5] , the following nonlinear discrete-time 
stochastic difference equation describing the aircraft dynamics are 
obtained : 

x(k+l)=Ax(k) + B(x(k) ) [u(k)-b^(k) ] + u^ + w(k) (2.1) 
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where the six dimensional vectors u and are composed of 

accelerometer and rate gyro measurements, and their associated 

2 

biases, respectively, “ [0,0, t g/2, 0,0, xg, 0,0, 0,0,0] ' where g 

is the earth's gravitational constant. The vector Ug represents 
the incremental effect of the earth's constant gravitational force 


on the system state. 



The matrices A and B are defined by 


B(x(k)) = 



Tgg(x(k)) O 
T^g(x(k)) O 

xTgj^(x(k) ) 


O 


( 2 . 2 ) 


is the 2x2 system matrix associated with the wind dynamics. The 
3x3 matrix T^g is the transformation from the body axes into the G 
frame [4] given by: 


I 



i c6ci|j 
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where f^,0,i/;are the Euler angles and c,s, and t are abbreviations 
for cosine, sine and tangent functions, respectively. T^^ is the 
3x3 matrix relating the body rates to the Euler angles [4] defined 
by : 
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w(k) , is given by 

O -I 
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(2.5) 


/ 




a w Q^e 


where V and V are the measurement noise variances for the 
a rg 

accelerometers and rate gyros, and Q„ is the process noise variance 

w 

associated with the wind dynamics. 


Note that the system matrix A is constant. However, both the 
process noise variance, Q(k) , and the system input matrix, B, is 
state dependent due to the nonlinear state dependent transformation 
Tgg and Now let us consider the measurement equations for the 

system described by eqs. 2. 1-2. 5. Let 

the azimuth and elevation antenna locations in the runway frame. 
Then, for the MLS range (y^j^) / azimuth (y^^^ ' elevation 

measurements are defined by: 


rn 


= r 


az 


+ b + V 
rn rn 


( 2 . 6 ) 
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( 2 . 7 ) 


''az 

y^j=sin-l[(-r^tzj)/r^j,]+b^j + 

where (b^„,b ,b^„ ) and (v^„ , , v^. ) are biases and measurement 
Lii Gy, irn az 0^ 

noises associated with the MLS and aircraft range 

from the azimuth and elevation antennas given by: 

■'az <2.9) 

■^e*'l/<W'-^<>^y-yE>"*<>^z-"E'' ‘2.10) 

Now consider the air data computer (ADC) outputs. In general^ 
the ADC would provide indicated airspeed, angle of attack and 
sideslip angle. In our problem, sideslip measurement is not 
available. In the software provided by NASA, the airspeed 
measurement is converted into two pseudo horizontal wind 
measurements by assuming zero angle of attack, sideslip and pitch. 
While the assumptions on the angle of attack and pitch can be 
relaxed, we will not use the same approach due to the following 
reasons. First, the pseudo wind measurement noises are correlated 
and state dependent. Secondly, the pseudo wind measurement 
failures would be dependent on each other, resulting in a complex 
failure detection scheme. 

Assuming a zero angle of attack, the airspeed indicator 

output, would then be a noisy version of the aircraft velocity 

sp 

with respect to the atmosphere given by: 


16 



( 2 . 11 ) 


y__ =l/(f v“'^v) 

■* sp y X X y y z sp sp 

where ('^x^'^y^ horizontal wind components and b^p and v^p 

are the IAS normal operating bias and white measurement noise. If 
the angle of attack measurement is available, then eq.(2.11) would 
be appropriately modified. 

The IMU platform provides the Euler angle outputs. These roll 
(y^) f pitch (yg) , and yaw (yi|)) angle measurements are modelled via 

+ V" V 

7g - & + b^ + Vq (2.13) 

Y = ^ + b + V (2.14) 

^ 'P 

where (b^,bQ,b^|^) and biases and white 

measurement noises associated with platform outputs. Defining. the 

measurement vector, y ' = [ymyaz^eil ^sp^jz^^G^ii; ^ system dynamics 

output becomes 


y(k+l) = h(x(k+l)) + by + v(k+l) 


(2.15) 


where b„ is the output sensor bias vector defined by b' = 

y ^ ^ y 

[b b b b^ b ,b b ,] ' and v is the measurement noise vector defined 

rn az ex, sp 0 9 If; 

by v' = [v^^v^^v^^VgpV^VQV^jj] ' . The nonlinear measurement function 
h(x) is defined by eqs. 2.6-2.14. In the next section, the no-fail 
filter which estimates the state variables and the normal operating 
biases of the stochastic nonlinear dynamic system described above 
will be discussed. 
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2.3 No-Fail Filter 


The no-fail filter, to be described in this section, is an 
extended Kalman filter which estimates the aircraft runway position 
and velocity attitude and horizontal winds along with the normal 
operating biases of its inputs and measurements. The estimator 
uses either RSDIMU body rates, or a set of body mounted 
accelerometer and rate gyro measurements as its inputs as discussed 
in the previous section. In the case of replicated inputs, 
redundant accelerometer and rate gyro sensors are kept as standby 
equipment.. MLS range^ azimuth and elevation sensors and the IAS 
provide the measurements into the filter. If desired, IMU platform 
outputs, or RSDIMU computed attitudes, can also be included in the 
measurement set. For the case of hardware redundant measurements, 
the no-fail filter uses an average of the replicated sensor outputs 
as its measurement. In this way, filter size is kept to a minimum, 
without loss of generality. The no-fail filter also estimates the 
normal operating biases of any specified subset of the sensor 
complement. 

The possibility of using one of the two filters NASA supplied 
for the no-fail filter was investigated. Of these filters, the 
first, a set. of three decoupled complementary .filters, was 
discarded because: 1) filter performance under a subsistent MLS 
measurement dropout was severely degraded due to the way the pseudo 
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MLS measurements were computed, and 2) any sensor failure resulted 
in coupling the three complementary filters together. It was also 
decided not to use the second filter which was a Kalman filter 
based on the approximate error dynamics arising from the aircraft 
point mass equations of motion. This decision was due to the 
complexity involved in deriving the equations for the propagation 
of sensor errors through the Kalman filter-navigation structure 
utilized. 

In the process of obtaining the EKP used in our study, we have 
extended the separate bias estimation algorithms for linear systems 
to nonlinear systems via the extended Kalman filter framework. Our 
extension yields a numerical decomposition procedure for obtaining 
the extended Kalman filter gains. At each sampling instant, the 
algorithm sequentially computes: 1) a bias-free gain; 2) bias 
correction matrix; 3) bias gain; and 4) correction to the bias-free 
gain. Background material on separate bias estimation algorithms 
can be found in Appendix B. 

To understand the operation of the no-fail filter, a signal 
flow diagram is shown in Figure 3. The filter can be sectioned 
into two portions, each of which resembles a linear discrete Kalman 
filter, except for the nonlinear evaluations of B and h, and the 
manner in which K^^ and Kj^ will be determined. The lower portion of 
the diagram can be viewed as a normal-operating bias filter. Its 
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Figure 3. No-Fail Filter Block Diagram 
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input is the residual sequence r(k+l) from the upper portion, and 
its outputs are the estimates by(k+l) and b^(k+l). The upper 
portion, labelled "bias-free" filter, accepts u(k) and Ug as its 
inputs (where Ug is the incremental effect of earth gravity on the 
filter state) , and y(k+l) as its measurement vector. The output of 
the "bias-free" filter is the residual sequence r(k+l), and the 

/s 

state estimate, x(k+l). While the diagram clearly shows the 
conceptual decoupling of the "bias-free" and bias filters, it also 
exposes the direct coupling that exists between the two portions. 
For example, notice how the input and output bias estimates feed 
back to effect the state estimator, and how the current value of 
the propagated state estimate, x(k+l/k), affects the residual 
sequence (and therefore the bias estimator) through the nonlinear 
evaluation of h(.). Not shown in the block diagram is the implicit 
functional dependence of the Kalman gains ^^'^b several 

quantities to be defined shortly. To implement this filter one 
need only define the functional form of B{.) and h(.) along with an 
algorithm for determining the Kalman filter gains. 

The computational aspects of the EKF algorithm will now be 

derived for the system dynamics described by eqs. 2.1-2.15. First 

combine the input and output bias vectors of the previous section 

to form a composite bias vector b as b'=[b',b']. The system state 

u y 

and bias initial conditions are assumed to be zero mean Gaussian 
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random variables with variances Pjj(O) and Pj^CO) , respectively. In 
addition, it is assumed that the measurement noise {v(k) ,k=l,2, . . . } 
is a zero mean, white Gaussian sequence with variance R(k) . 
Furthermore, the plant state and bias initial conditions, 

measurement and process noise sequences are all assumed to be 
mutually uncorrelated. In Appendix B, it is shown that the EKF* 
equations for the nonlinear system dynamics described by eqs. 
2.1-2.15 will be given by 

/V /V A. 

x(k+l)=Ax(k)+B(x(k) )u(k)+Ug+K(k+l,x(k+l/k) ) r(k+l) (2.16) 

A. A. A 

b(k+l)=b(k)+Kjj(k+l,x(k-tl/k) )r(k+l) (2.17) 

where the innovations sequence of the no-fail filter, r(k+l), is 
given by: 

A A 

r(k+l) = y(k+l) -h(x(k+l/k)) -Db(k) (2.17a) 

A 

and the bias compensated input vector, u(k) , is given by: 

A A 

u(k) = u(k) - Bj^b(k) (2.17b) 

A A A A 

Note that Db(k) = b (k) and B,b(k)= b (k) ; therefore, these 

y DU 

matrices are defined as D = [0 I] , Bj^ = [I 0] if all input and 

output biases are estimated. The filter gain partition, is 

defined by: 

* Reference [6] contains the derivation for the case when the state 
transition matrix is also nonlinear. 
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Kj^(k+I,x(k+1A)) =KQ(k+l,x(k+lA)) + V(k+l,x(k+lA) ) %(k+l,x(k+lA) ) (2.17c) 

and K^(k+l,x(k+l/k) ) ,V(k+l,x(k+l,k) ) and (k+1, x (k+l/k) ) are 
computed sequentially using the linearized quantities; 


F(x(k),u(k)) =A+ i^(x(k))u(k) 

8x x(k) fU(k) 

H(x(k+l/k) = ^x{k+D) . 

3x x(k+l/k) 


(2.18) 


(2.19) 


The expressions for the above partials are given in Appendix A. 
Using the terminology associated with the linear case, the 
bias-free filter gain will then be computed by: 

/V yv /N 

KQ(k+l,x(k+l/k) ) = PQ(k-tl/k) H' (x(k+l/k) [H(x(k+l/k) 

pQ(k+l/k)H' (x(k+l/k)+R(k+l)]"^ (2.20) 

and the bias-free prediction error covariance will be given by 

PQ(k+l/k)=F(x(k),u(k))PQ(kA)F' (x(k)u(k)) +Q(^(k) ,k) (2.21) 

where eq.(2.21) is initialized with Pq (0/0) =P^^ (0) and the bias-free 
filtering error covariance will be computed by 


Pq ( k+l/k+1) = [ I-K^ ( k+1 , X ( k+l/k ) ) H (X ( k+l/k ) ) ] P^ ( k+l/k ) 
[I-KQ(k+l,x(k+l/k) )H(x (k+l/k)] ' 
+K^(k+l,x(k+l/k) )R(k+l)K^(k+l,x(k+l/k) ) (2.22) 
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Note, the bias-free filter gain and the prediction error 
covariance are computed using H evaluated at x(k+l/k) and F 
evaluated at x(k) as opposed to the linear case where one would 
evaluate them about the bias-free estimates. 

The bias-correction matrix V is computed recursively as 

/V /N. /\ /S 

V (k+l,x (k+l/k) ) = [I-KQ(k+l,x (k+l/k) ) H (x (k+l/k) )]F(x(k) ,u(k)) 

V(k,x(k/k-D) 

As ^ /N 

+B(x(k) )-KQ(k+l,x(k+l/k) [H(x(k+l/k) )B(x(k) )+D] (2.23) 

where the matrix C is defined by 

C(k+l,x(k+l/k) )=H(x(k+l/k[F(x(k),u(k) )V(k,x(k/k-l) )+B(x(k) ) ]+D{2.24) 

The bias filter gain is expressed as 

Kj^(k+1, X (k+l/k) )=Pj^(k+l/k+l) [H(x(k+l/k) ) V(k,x(k/k-l) ) +D] 'R(k+1) (2.25) 

The bias filter error covariance, Pj^, can be computed recursively 
by propagating the information matrix as 

Pj^"^ (k+l/k+1) =P ( k A ) +C ' ( k+1 , X ( k+l/k ) ) r"^ ( k+1 ) C ( k+1 , x ( k+l/k ) ) ( 2 . 26 ) 


where 


;-i 


R -^(k+l) = [l/v(x (k+l/k) )PQ(k+l/k)H(x (k+l/k) +R(k+1) ] "-{2.26a) 


-1 
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The state estimation error covariance Pjj(k+l/k) , bias estimation 
error covariance Pj^(k+l/k ) , and cross covariance of state and bias 
P^j^(k+l/k) together define the prediction error covariance for the 
composite no-fail filter. They are defined by [7] , [14] : 

Pj^(k+l/k)=PQ(k+l/k) + [F(x(k) ,G(k))V(k,x(k/k-l))+B(x(k))]Pj^(k) 

[F(x(k),u(k))V(k,x(k/k-l))+B{x(k))l ' (2.27) 

Pjjb(k+l/k) = [F(x(k) ,i(k) )V(k,i(k/k-l))+B(J(k) )]Pj^(k) (2.28) 

Pj^(k+l/k)=Pj^(k) (2.29) 

where P^(k+l/k) is the prediction error covariance associated with 
the bias-free computations given by eq.(2.22), the bias correction 
matrix V is defined by eq. (2.23), and the bias error covariance is 
computed using eq. (2.26). 

Figure 4 summarizes the computational operations involved in 
this realization of the fail-free filter. The computational 
sequence given above for obtaining the filter gains provides a 
numerical decomposition for the extended Kalman filter gain 
computations and has the following advantages. First, numerical 
accuracy will be improved due to the lower order matrices involved 
in the numerical decomposition. Moreover, finite variance for the 
plant state initial conditions and infinite uncertainty in the a 
priori bias estimates can be handled easily within this framework. 
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Figure 4. No-Fail Filter Computational Flow 
Diagram 
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In addition, the flexibility introduced by the new filter structure 
can be used to meet other desired design goals. For instance, 
bias-free and bias gain computations can be performed at different 
speeds to reduce computational costs. 

In the next section, the operation of the detectors, which are 
driven by the expanded innovations of the fail-free filter 
described above, will be discussed. 

2.4 Detector Implementation 

In this section, the blocks in Figure 1 labeled, "residual 
computation" and "detectors" will be examined in detail. From an 
input-output point of view it is seen, from Figure 1, that the 
residual computation block receives as inputs, the "raw" sensor 
measurements (replicated) and the "no-fail" filter's best estimate 
of the (unreplicated) measurements. It gives as its output an 
expanded residual and inverse of the innovations covariance for 
these expanded residuals.* These expanded residuals, in turn, 
drive a bank of low order detectors, where each detector delivers a 
failure corrected residual to the likelihood ratio computers. The 
function of a detector therefore is to track the occurrence and 

^ Remember that the no-fail filter receives only the averaged 
measurements; therefore, the residuals for the individual sensors 
have to be further computed in order to be able to distinguish 
failures in like sensors. 
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level of a sensor failure and compensate the residual sequence of 
the no-fail filter such that its effects are removed from the 
residuals. 

The detectors to be defined in this section will be 
conditioned on the occurrence of a single sensor failure. 
Essentially, they estimate the level of a bias jump in a sensor 
output, which is hypothesized to occur at a time kg Furthermore, 
detectors operate over a "window” of the expanded residuals, with 
the initial failure level estimates and uncertainties reset at the 
beginning of each residual window. The start of a new window 
determines the hypothesized time of failure kg, and the maximum 
length of the window determines the time to wait before initiating 
a new hypothesis. In the case considered (single sensor failures) , 
the total number of detectors is equal to the sum of the number of 
input sensors and the number of output (replicated ones included) 
sensors. For instance, in the case of dual sensor failure 
redundancy there would be twenty of these first order detectors: 
three for the body mounted accelerometers, three for the body 
mounted rate gyros, six for the MLS measurements, two for the IAS 
outputs, and six for the IMU measurements. 

In discussing these issues, it is convenient to define sensor 
type to be the generic type of the sensor measurement of interest, 
such as MLS azimuth, or body p gyro output, whereas sensor 
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replication refers to the particular replication of interest (i.e.. 


second replication of MLS range) . The replication will be noted by 
a superscript in the text (i.e., = first replication of MLS 
azimuth) . 


The residual computation block of Figure 1 has a 
straightforward function? it serves to generate the residual 
sequence and innovations covariance that would have emerged from 
the no-fail filter if the individual sensor measurements had been 
presented to it, rather than the averaged measurements > The 
residuals are formed as follows (eliminating the time index for 
clarity) ; 


defining 



= ^az 

~ y 
^ az 

2 

2 

/s 
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= y 

“ y 

az 

^ az 

az 


’ 1 1 

2 2" 
r = y - y 

^ ip 




(2.30) 


(2.31) 


(2.32) 


the expanded innovations can be written as: 

r^(k+i) = \y]~y] = 

Ly ~yj j_y (x (k+l/k) — Db^ (k) J 
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The innovations variance of the expanded, R(k+1) , is found by 


straightforward substitutions to eq. (2.26a) as; 


R(k+1) 


rH(k+l) dT FP^(k+l/k) P^j^(k+l/k)l rH(k+l) d1^ Tr Q1 
LH(k+l) DJ [p^j^(k+l/k)' Pj^(k+l/k) J [H(k+1) [o rJ 

(2.34) 


= [H(k+D d] rP^(k+l/k) 
Lp'b(k+lk) 


P^b(k+l/k)l [H(k+D Dj^ + R(k+1). 

PfaCk+l/k) J (2.34 


where R is the measurement noise covariance for each set of 
replicated measurements. Eqs. 2.30-2.34 completely define the 
function of the residual computation block. 


The function of the detectors is clearly two-fold. First, the 
detectors must keep track of how each hypothesized sensor failure, 
occurring at time k^, propagates through the system dynamics to 
effect the expanded residual sequence of the no-fail filter, as 
well as track its direct effects on the residuals. Secondly, it 
must estimate the level of the sensor failure so as to eliminate 
its effect on the residuals. The ensuing outline for the detectors 
will define these functions in that order. A typical (say, i'th) 
input sensor detector estimates a postulated bias jump in the i'th 
input at time k^ so that the i'th input sensor detector design is 
based on the following modification of the system dynamics given by 
eq . ( 2 . 1 ) : 
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x(k+l) = Ax (k) +B (x (k) ) [u(k) -b^] +B^ (x (k) ) (k) +Ug+w (k) (2.35) 

(k+1) =nij^ (k) with m^(kQ)=mj^ and m^(k)=0 for k<k^ (2.36) 

where Bj^(x(k)) is the i'th column of the input matrix B(x(k)) and 
m^ is the failed bias jump magnitude of the i'th sensor to be 
estimated. On the other hand, the detector for the i'th output 
sensor failure is based on the following modification of the 
measurement equation given by eq. (2.15) : 

Y(k+l)=h(x(k+l) )+by+D^m^(k)+v(k+l) (2.37) 

mj^(k+l) =m^(k) with "ii(kQ)=mj^ and mj|^(k)=0 for k<k^ (2.38) 

where m^ is the failed bias jump magnitude for the i'th output 
sensor and is a column vector with unity entry at the i'th row 
and zeroes elsewhere. It is assumed that the failed bias jump 
magnitudes are unknown nonrandom variables. As mentioned 

previously, the residuals of the no-fail filter serve as 

measurements to the detectors. In Appendix C, it is shown, under 
suitable assumptions, that the residual of the no-fail filter, as 
defined by eq. (2.17a) in the case of i'th failure hypothesis will 
be given by: 

rQ(k+l)=C^(k+l,x(k+l/k) )m^+r (k+1) (2.39) 
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where r(k) is the innovations of the no-fail filter under the 
no-fail hypothesis. Therefore, r(k) is a zero mean white noise 
sequence with variance R(k+1) defined by eg. (2.34). Referring 
back to eg. (2.39), r(k+l) would then be the measurement noise in 

yv 

the i'th detector model and the measurement matrix (k+l,x (k+l/k) ) 
would be given by (see Appendix C for the derivation) ; 


Cj^(k+l,x(k+l/k) ) = [H(x(k+l/k)) D] 
+ [H(x(k+l/k)) D] 


F^(x(k) ,u(k) ) B(x(k)) 


V. (k, x(k/k-D) 
V^j^(k, x(k/k-D) 


B^(x(k) 

L 0 


n ^.D. 


(2.40) 


Notice, consists of two portions: the left most matrix product 

shows how the failure propagates through the dynamics to affect tu., 

residuals; the middle product depicts the direct effects of input 

failures, and the right most matrix illustrates the direct effect 

of output failures. Furthermore, B^(x(k)) is zero in the case of 

output sensor failures and, is zero in the case of input sensor 

/\ 

failures. The matrix F^(x(k) ,u(k) ) is defined by: 


F^(i(k) ,i(k)) = F(x(k) ,u(k)) - 


3 B^ (x(k) )m^ 
9x 


.V (2.41) 

x(k) ,m. (k) 

1 


where F(x(k),u(k)) is given by eg. (2.16). Note, for output 
failures = F since those failures do not enter through the 
input weighting matrix B. 
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The matrix I is analogous to the bias correction matrix 
given by eg. (2.23) and represents the propagation of a sensor 
failure, occurring at time through the no-fail filter dynamics. 
It is computed using the following recursive relationship: 



The state dependency of variables above has been suppressed for 
ease of presentation. The gains and Kj^ are given by eqs. (2.17c) 
and (2.25). Note that eg. (2.42) is similar to the bias correction 
matrix recursive relation given by eg. (2.23). In fact, the formula 
above can be obtained by replacing by K^, H by [H D] , F by 
B by B., and D by D. in eg. (2.23) . This is to be expected 

T 1 1 


F. B 

L iJ K 


since 


‘v. 

1 


represents the effect of a sensor bias failure on the 
composite no-fail filter and V(k+1) represents the effect of a 
normal operating bias on the bias free portion of the fail free 
filter. The postulated sensor failure's effect on both state and 
normal operating bias estimates are thus computed. 


Summarizing, the i'th detector design is based on the 
observation model described by eg. (2.39) and (2.40) and constant 



failure dynamics. The development up to this point has assumed the 
value of m^ is known. In reality, m^^ is nonrandom, but unknown. 
Therefore, one must continuously estimate its value. 

The i'th detector estimate, mj^(k) , of the i'th sensor failure 
jump, m^(k) , can be computed by the following first order linear 
Kalman filter for the case of output sensor failures, and by a 
first order approximate nonlinear filter in the case of input 
sensor failures: 

m^(k+l)=m^(k)+Gj^(k+l,x(lc+l/k)) [r(k+l)-Cj^(k+l,x(k+l/k))mj^(k)] (2.43) 
where the detector estimate mj^(k) is initialized at the start of a 

ys 

residual window with m^(k^)=0. Figure 5 shows the simple operation 
of this filter. The detector gain is computed by: 

G^(k+l,x(k+l/k))=P^(k+l/k+l)C^' (k+l,x(k+l/k) )R (k+1) (2.44) 

where P^(k+l/k+l) is the error covariance of the i'th detector bias 
jun^ estimate. The information matrix, P^ ^(k/k), of the i'th 
detector is propagated recursively through: 

Pr^(k+lA+l)=Pi~^(kA)+C^' (k+l,x(k+lA) )R~^(k+l)C^(k+l,x(k+lA) ) (2.45) 

with 
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Figure 5. Block Diagram for i ' th Detector 


That is, the failure bias jump at time is assumed to be a zero 
mean random variable with infinite covariance (or equivalently, 
zero information) . In the case of output sensor failures, the 
detector implementation described by eqs. (2. 43) - (2. 45) above is an 
exact linear Kalman filter for the hypothesized failure model 
specified by eqs. (2. 37) - (2. 39) . In the case of input sensor 
failures, the detector becomes an approximate nonlinear filter due 
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to the dependence of in eq. (2.41) on the failure bias magnitude, 
ni£ , where mj;(k) is used in the evaluation of (x (k) ,u (k) ) . 
Figure 6 summarizes the computational operations required to 
implement each detector, and clearly shows the function of the 
detectors. 

In summary, the detector block consists of a bank of first 
order estimators driven by the expanded innovations of the no-fail 
filter. Each detector corresponds to a different sensor failure 
hypothesis, and, corresponding to each detector, there is an 
associated residual data window length. The bias jump magnitude 
for a given sensor failure, hypothesized to happen at the start of 
the residual window, is estimated by the detector corresponding to 
that sensor. The residuals of the detectors along with the 
residual of the no-fail filter are used in the decision block which 
is discussed in the next section. 

2. 5 Decision Logic 

As seen in Figure 2, the failure compensated residuals from 
each of the sensor failure detectors along with the expanded 
innovations sequence of the no-fail filter are used in deciding the 
most likely failure mode. To arrive at this decision, M-ary 
hypothesis testing, based on a decision residual window, is 
utilized. The problem is viewed as follows: Given M sensor 
failure models, formulate the following M+1 hypotheses: 
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Hq 5 r^{k)=r(k) ,k=k^,k^+l, . . . ,k^+£ 

(2.46) 

^i* r^(k) =r (k) +C^(k,x(k/k-l) )m^ 

where r^{k) is the actual expanded innovation sequence of the 
no-fail filter, r(k) is the innovations sequence of the no-fail 
filter under no— fail conditions, and ^ is the length of the 
decision residual data window on which the M-ary hypothesis test is 
based. Recall from the previous section, that r(k) is a zero mean 
white noise sequence with variance R(k) defined by eq. (2.34), The 
length of the decision residual window is, in general, different 
from the estimation residual data windows described in the previous 
section. In summary, an M-ary hypothesis test will be used to 
decide whether the no-fail filter is operating under no failures 
(hypothesis H^) , or under the i'th sensor bias jump failure 
(hypothesis H^) . 

The M-ary hypothesis test chosen minimizes [20] the Bayes 
risk, 3 , given by: 

MM 

6 = ^ 2!^ ^ij^H-y p(Y(K)|Hj)dY (2.47) 

i=0 j=0 ^ ^i 

where 

j : cost of accepting when H j is true 

Pjj : a priori probability of hypothesis Hj being true- - 
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Y^; decision region in the observation space such that 
hypothesis is selected if Y(K) is in region Y^. 

Y(K): [r (k^) ,r (k^+1) , . . . ,r (K) ; k^<K<k^+£] observations (in 

our case, innovations sequence of the no-fail filter) on which 
the test is based. 

p(Y(K)lHj): probability density of the no-fail filter 

residuals conditioned on the j'th hypothesis 


Bayes risk is a weighted cost of making incorrect decisions. As 

shown in [20] , tha Bayes risk is minimized, by choosing hypothesis 

H. corresponding to the smallest of M+1 possible g^^'s defined by: 

M 


3 i(r(K))= Pjj C. . p (Y(K) |H.) 
D=0‘ 3 


(2.48) 


i=0 , 1 , . . . ,M 


In our case, the conditional probability density above 
(assuming a Gaussian distribution) will be given by: 

' / K 1 \ 

P(Y(K)|h.) = n (27T)I^/Mdet (R(k) )^ / ) 

J ' k=k , 

d (2.49) 

with A^(r(K)) defined by 

K 

Aj(r(K) )=Pjj exp{-l/2 r I (k) (k) r . (k) } (2.50) 

3 k=k^ 

where rj(k) is the j'th detector residual sequence (given in 
(2.43)) defined by: 


39 



(k+1) =r^ (k+l)-Cj(k+l,x(k+l/k) )mj(k) 


(2.47) 


Since the denominator term in (2.49) is not "i" or "j" dependent 
and positive, an equivalent decision would be to choose 
corresponding to the smallest 

M 

^^(r(K)) = 5^ C..A.(r(K)) (2.52) 

j=0 

1 

In computer implementation, A s are usually scaled byA^ so 
that they become likelihood ratios. If the costs associated with 
making wrong decisions are all equal and those of making correct 
decision are zero (i.e., C^j=l for i?^j and C^^=0) , then the optimal 
Bayesian decision would be to choose corresponding to the 

smallest one of the M+1 a^^'s given by: 


K 

a,. (r(K) )= +1/2 (>!) (k) r . (k) -*nP„ (2.53) 

k=k^ ^ ^ «i 

In this case the decision rule is equivalent to choosing hypothesis 

corresponding to the largest a posteriori probability: 

Ai(r(K)) 

= -M {2.5 

Aj (r (K) ) 

3 ^ 


where P(H^|Y(K)) is the a posteriori probability that is the 
true hypothesis conditioned on the residual window Y(K). 



III. SIMULATION DESCRIPTION 


The performance of the filter-detector algorithm has been 
analyzed by using a six-degree-of-f reedom simulation of the TCV 
Boeing 737 aircraft along with the dual fail-operational 
two-degree-of-freedom strapdown inertial measurement unit (RSDIMU) 
software model. These NASA supplied simulation computer programs 
were first converted from CDC FORTRAN Extended 4 into DEC 
FORTRAN-10 in order to run them on the BBN computer system. In 
single precision (36 bit ) , the aircraft simulation exhibited 
significant ground track, cross track and glideslope errors. The 
numerical problems were traced down to the algorithms used in 
computing waypoints and guidance parameters in earth centered 
inertial frame. The numerical inaccuracies were alleviated by 
converting the whole program into double precision (64 bit) . The 
aircraft simulation and the RSDIMU programs were then integrated to 
permit the use of the RSDIMU as an aircraft sensor. Later, new 
sensor models were developed and appended into the simulation to 
provide more realistic normal operating errors. Finally, sensor 
failure models for increased bias, hardover, null, scale factor, 
ran^) and increased noise type sensor malfunctions were assimilated 
into the software. 

In this chapter, the aircraft and sensor dynamics simulation 
model will be discussed. Section 3.1 contains a discussion of the 
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sensor models. Sensor failure models are discussed in Section 3.2. 
3.1 Sensor Models 

During the early phase of the contract, sensor models for the 
aircraft sensor complement were developed in order to provide 
realistic normal operating sensor errors. These models have been 
integrated into the NASA supplied TCV B-737 aircraft simulation. 
The generalized sensor models take in true values of measured 
variables from the aircraft simulation and put out sensor outputs 
which account for misalignment, measurement noise, bias drift, 
normal scale factor errors and limits. The model for the rate 
gyros is described below to outline the features of the modified 
sensor models. 

1. Rate Gyro Misalignment ; The true body rates (p,q,r) 
expressed in the orthogonal body axes are first transformed into 
the nonorthogonal measurement axes via a small angle transformation 
to account for rate gyro misalignments: 



where body rates after the misalignment and 

(0 ,9 ,0 ,0 ,0 ,0 ) are six small independent misalignment 

xy yx xz zx yz zy ^ 

angles expressed in radians. In our simulation, the misalignment 
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\ 

angles are randomized by specifying the expected standard deviation 
of the misalignment angles. For instance, rate gyro misalignment 
angles in the following simulation runs are randomized with 0.03°, 
as seen in Table I. 

2. Measurement Noise ; The misaligned quantities are 
corrupted by zero mean white Gaussian noise 
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where (Vp»Vg,Vj.) are zero mean white Gaussian sequences with unit 
variance and ( ^ ^ are the standard deviation of the 

r' SI ^ 

measurement noise in the sampled signal given by 
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where standard deviations of the measurement 
noise in the continuous (p,q,r) measurements and (f ) is the 
associated sampling frequency. 


3. Bias Drift; The bias drift is associated with calibration 
errors and electronic components of a sensor package and is modeled 
by 
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Table I. Normal Operating Sensor Model Parameters 


Sensor 

Units 

Roll Rate Gyro 

deg/sec 

Pitch Rate Gyro 

deg/ sec 

Yaw Rate Gyro 

deg/sec 

Body Mounted 
Accelerometer 

/ 2 
m/sec 

Body Mounted 
Accelerometer 

m/sec 

Body Mounted 
Accelerometer 

m/sec 

Airspeed 

Indicator 

m/sec 

MLS Azimuth 

deg 

MLS Elevation 

deg 

MLS Range 

m 

IMU Roll 
Attitude 

deg 

IMU Pitch 
Attitude 

deg 

IMU Yaw 
Attitude 

deg 


Std. Dev. deg 


0.03 


0.03 


0.03 


Bias* Scale Factor 
St. Dev. % 




.05 

.037 

.05 

.03 

4.57 

30.5 

0.27 

0.23 

0.23 i 

-0.19 

0.23 

0.15 






























































(3.4) 


Pb = Pn •'^pb ^ V 

^qb '^qb 


where (‘^pb»^qb'*^rb^ expected standard deviation of biases 
in the {p,q/r) measurements and (Vp^f Vqb^'^rb^ zero mean 
Gaussian random variables with unit variance. That is, the bias 
level will vary from one run to another, but stay constant during 
each run. On the other hand, the provisions for providing 
deterministic instead of random biases are also included in the 
program. 


4. Normal Scale Factor Error ; Normal scale factor errors are 
simulated according to: 


Ps = 

(1.+ 

.01 

X 

“ sp ''sp> 

X Pb 


^s = 

(1.+ 

.01 

X 

“sq =' ''sq == 

% 

(3.5) 

r = 
s 

(1.+ 

.01 

X 

°sr ''sr> 

^ ^b 



where ( ^sq'^ sr ^ expected standard deviation of the 
scale factor errors in the (p,q,r) measurements. As before the 
Gaussian random variables ('^sp'^^sq'^sr^ provide randomized scale 
factor errors. Similarly, deterministic scale factors can also be 
introduced in the program. As can be seen in Table I, rate gyro 
scale factor error standard deviation is 0.01%. 
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5. Limits: The computed quantities (p„rq„,r„) are compared 
with the sensor limits and set to the appropriate limit when these 
thresholds are exceeded. 

The other sensor models are essentially similar. The 
parameter values used for the models are given in Table 1. The 
measurement noise of indicated airspeed (IAS) is multiplicative. 
MLS measurement noises can be specified as either a white or 
time-correlated Gaussian sequence. MLS sensor models also simulate 
data dropout and filter errors associated with the digital scan 
mechanism of the microwave landing system. Further details on this 
model can be found in [1] , [18] . 

Two inertial measurement unit models have also been included 
in the simulation. The first one, IMU, is a platform whose Euler 
angle outputs are utilized as measurements in the program. The 
second one, RSDIMU, is a redundant strapdown package consisting of 
four two-degree-of-f reedom gyros and eight linear accelerometers in 
a semioctahedron configuration. The RSDIMU model simulates 
quantization errors in addition to additive noise, bias, scale 
factor errors. A detailed description of the RSDIMU model can be 
found in [2] . 

Sensor models were generalized to accommodate redundant sensor 
configurations. All sensors can now be dual or triple redundant 
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with the exception of the RSDIMU which has its own internal 
hardware replication. The software has been written so that any 
selected baseline sensor configuration can be handled. 

3.2 Sensor Failure Models 

The following failure modes have been incorporated into the 
software for each sensor: 

1. Increased Bias Failure : For instance, in the case of roll 
rate bias failure, the normal operating bias of p rate gyro is 
bypassed at time of failure for p gyro bias and the standard 
deviation of the bias level is increased by 

Cpb = KPFB X Upb (3.6) 

where KPFB is an integer to be specified. That is, each failure is 
specified by a time of failure and a ratio by which the failure's 
standard deviation exceeds the expected normal bias standard 
deviation. 

2. Hardover Failure : Hardover failures correspond to a 
completely nonoperational sensor status and they are modelled by 
setting the failed sensor output to its limit. For instance, q 
rate gyro hardover failure is simulated by setting the pitch rate 
gyro output to its positive or negative limit at time of failure. 
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Null Failure: 


3. 


Null failures also correspond to an 


unusable sensor failure mode and they are modelled by zeroing out 
the failed sensor output at time of failure. 


4. Scale Factor Failure : Scale factor failures correspond to 
a severely degraded scale factor error. For instance, in the case 
of yaw rate gyro scale factor failure, the standard deviation of 
the expected scale factor error is increased to 


^sr = V ^ 

at time of failure. The integer KRSF specifies the ratio by which 
the expected failure level exceeds the standard deviation of the 
normal scale factor error. 


5. Increased Noise Failure : These failures are introduced by 
increasing the sensor measurement noise at time of failure. For 
example, roll rate gyro noise failure is simulated by setting 

Up = KPFN X Op (3.8) 
where KPFN is the specified noise failure level. 

6. Ramp Failure : Provisions for introducing ramp failures 
have also been included. The modelling of these failures is 
similar to that of bias failures. 
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Any or all of the above failure inodes can be superimposed on 
any of the sensor models detailed in the previous section. 
Currently, the time of failure is deterministic (user specified at 
run time) so that the performance of single simulation runs can be 
compared to one other. However, randomized specification of 
failure times will eventually be programmed so that Monte Carlo 
averaging of the results can be done in an automated fashion. 
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IV. DISCUSSION OF RESULTS 


In this chapter, estimation and failure detection performance 
of the developed aircraft sensor fault tolerant system will be 
discussed by examining some typical simulation runs. Section 4.1 
is concerned with aircraft state and bias estimation performance 
when no failures occur. Whereas Section 4.2 investigates the 
filter performance under failures. Additionally, Section 4.2 is 
concerned with failure detection performance. 

4.1 System Performance - No Failures 

The simulation runs start at the point of transition to MLS 
coverage. The no-fail filter described in Section 2.3 is used to 
estimate aircraft position, velocity, attitude, and horizontal 
winds. In these runs, the body mounted accelerometers and MLS 
range measurement were selected for inclusion in the bias 
estimator. Therefore, the no-fail filter also provides sensor bias 
estimates for the body mounted accelerometers and MLS range 
measurement. 

The six-degree-of-f reedom simulation was run approximately 120 
seconds at 20 Hz. Figures 7 and 8 show the A/C ground track and 
bank angle profile. Body rate time histories for roll, pitch, and 
yaw are given in Figure 9. Altitude profile exhibits essentially a 
constant sink rate. These figures indicate the landing path and 
transient maneuvers encountered during approach. 
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Figure 7: Aircraft Ground Track 
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Yaw Rate r, deg/sec Pitch Rate q, dog/sec deg/sec 



Time, sec 

Figure 9: Body Angular Rate Profiles 
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Table II shows the values used for filter initialization. 


Initial uncertainty variances, both diagonal. 
Accelerometer biases are denoted by (b„,b„,b ) . Actual measurement 
bias levels are given in Table I. Table III contains the 
measurement noise standard deviation values used in the filter 
computations. Actual measurement signals generated in the 
simulation, however, also contain misalignment, normal operating 
bias, and scale factor errors depicted in Table I. Moreover, 
actual IAS noise is multiplicative. All measurement noises are 
uncorrelated with each other. The horizontal wind dynamics used in 
the filter were first order filtered noise with a time constant of 
1000 seconds. 

Figures 10 and 11 show the state estimation performance limit 
of the baseline EKP in which all sensor biases are set to zero. 
That is, position and attitude errors in Figures 10 and 11 are the 
lower limits which can be attained (for the particular run) with 
the selected normal operating error parameters (misalignment, 
noise, scale factor, etc.) even if the sensor biases can be 
perfectly identified. The detectors were also run with this 
baseline EKF and there were no false alarms. 

Notice that although both position and attitude estimation 
errors are quite low, attitude errors display regular, nonrandom 
patterns. These errors can be traced to integration errors in the 
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Table II. Filter Initialization 


triable 

Init. Est. Error 

Init. Uncert . (St. Dev. ) 

Units 

r 

X 

-21. 34 

36.58 

m 

r 

y 

13.72 

36.58 


r 

z 

- 4.57 

27.43 

m 

• 

r 

X 

0.61 

2.29 

m/sec 

• 

r 

y 

1.52 

4.57 

m/sec 

• 

r 

z 

- 0.31 

1.07 

m/sec 

<t> 

0.02 

0.3 

deg 

0 

- 0.11 

0.3 

deg 


- 0.2 

0.64 

deg 

w 

X 

- 0.09 

0.6 

m/sec 

w 

y 

0.2 

0.6 

m/sec 

b 

X 

0.1 

0.3 

m/sec^ 

b 

y 

- 0.05 

0.3 

m/ sec^ 

b 

z 

. 07 

0.3 

2 

m/sec 

^rn 

30.5 

91.44 

m 


0.23 

0.8 

deg 

^6 

- 0.19 

0.8 

deg 


0.15 

2.4 

deg 
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Table III. Filter Process and Measurement Noise Levels 


Measurement 

St. Dev. 

Units 

X accelerometer 

0.1 

m/sec ^ 

y accelerometer 

0.1 

m/sec^ 

z accelerometer 

0.1 

m/sec 

p rate gyro 

0. 02 

deg/ sec 

q rate gyro 

0.02 

deg/sec 

r rate gyro 

0.02 

deg/ sec 

X wind 

0.6 

m/sec 

y wind 

0.3 

m/sec 

^az 

0.05 

deg 

yeA 

0.05 

deg 

^rn 

4.57 

m 

y^sp 

0.5 

m/sec 


.23 

deg 

CD 

.23 

deg 


.23 

deg 
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mechanization of the no-fail filter. This is due to the fact that 
the no-fail filter is integrating the body rates too slowly. In 
fact, if one compares Figures 9 and 11, it will be clear that the 
estimation errors are correlated with rate gyro transients. The 
position errors are less effected by this problem since the 
acceleration signals do not have sharp transients and because high 
quality MLS measurements are filtered into the position estimate. 

All of the simulation runs correspond to a dual redundant 
sensor configuration. As discussed in Section 2.4, there are 21 
possible sensor failure modes in this case since redundant input 
sensors (body mounted accelerometers and rate gyros) are kept as 
standby equipment. Table IV describes the 21 hypotheses 
corresponding to various sensor failures. 

In all of the following runs, the a priori probability of the 
no-fail hypothesis was set to 0.9999, while a priori probabilities 
for the remaining hypotheses, corresponding to various sensor 
failures, were all equal to each other. The Bayesian costs in 
Section 2.4 were selected such that there were no costs associated 
with making correct decisions and costs of making incorrect 
decisions were the same. Therefore, the chosen hypothesis 
maximizes the a posteriori probability. 
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Table IV. Failure Modes for Dual Redundant Sensor Configuration 


Hypothesis 

Failed Sensor 


a accelerometer 

1 

X 

H- 

a accelerometer 

2 

y 

«3 

a accelerometer 
z 


p rate gyro 

»5 

q rate gyro 

»6 

r rate gyro 


first MLS azimuth 

“8 

first. MLS elevation 


first MLS range 

«10 

first IAS 

»11 

first IMU roll attitude 

«12 

first IMU pitch attitude 

«13 

first IMU yaw attitude 

«14 

second MLS azimuth 

«15 

second MLS elevation 

»16 

second MLS range 

«17 

second IAS 

«18 

second IMU roll attitude 

«19 

second IMU pitch attitude 

«20 

second IMU yaw attitude 

«21 

none that are used by the no-fail filter 
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The next set of Figures, 12-14, show the state estimation and 
the normal operating bias identification performance of the no-fail 
filter. As expected, the normal operating biases degrade the 
estimation performance of the no-fail filter. It is also seen that 
A/C velocity and position estimates improve as the accelerometer 
bias estimates converge. Furthermore, the steady-state position 
errors can be directly attributable to the azimuth and elevation 
bias levels. However, these errors will decrease as the range 
diminishes, thereby eliminating any need to estimate small biases 
on MLS azimuth and elevation. Note that the only coupling that 
exists between the Euler angles and the runway position and 
velocity is through the input partials defined in eq.(2.18). 
Furthermore, the strongest coupling is to the heading angle. This 
coupling produces a slightly larger reduction in the heading angle 
uncertainty compared to bank and pitch angle variances. The 
simulation results also suggest that the Euler angles can be 
con 5 >uted separately without substantially lowering estimation 
performance, thus minimizing overall filter complexity. 

Convergence performance of the accelerometer bias estimates 
can be seen in Figure 14. Relatively slower rate of convergence 
for the z-accelerometer bias estimate compared to the other two is 
due to the fact that the IAS essentially measures the velocity 
along the x and y axes. Therefore, z-accelerometer input needs to 
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Figure 14; Normal Operating Bias Est. - Failure Free 
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be integrated twice for a measurement (mostly MLS elevation) 
comparison. The good convergence performance of the accelerometer 
bias estimates are typical of the results from other runs with 
different bias levels. The lower bound of the uncertainty in bias 
estimates (not shown) compares favorably to the actual estimation 
error. 


Further note that the accelerometer bias estimates need not 
exactly converge to the values given in Table I due to misalignment 
and scale factor parameters. For instance, the z-acceleration is 
nearly constant in these runs so that the scale factor error 
associated with the z-accelerometer produces a different bias level 
for the z-accelerometer. Depending on the misalignment angles, the 
z-acceleration would also produce an additional constant bias in 
the X and y accelerometers. It was also observed that horizontal 
wind estimation performance strongly effects the settling time for 
the accelerometer bias estimates. 

The MLS range bias estimation error is depicted in Figure 14. 
The relatively sharp initial change in the estimate compared to the 
input bias estimates was typical of the other runs in which 
elevation and azimuth biases were also estimated. This behavior is 
due to the fact that there is less filtering of the measurement 
residuals in obtaining the output bias estimates. 
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From our experience with several runs using different bias 
levels, initial conditions, and initial uncertainties, we have 
found the numerical stability of the no-fail EKP implementation to 
be as good as the L-D factorization formulation [21] of the EKF for 
the augmented system. The overall performance of the filter is 
typical of the EKF applications with the largest estimation errors 
occurring during startup and abrupt dynamic changes (in our case, 
during A/C maneuvers in which the linearity assumptions are most 
severely violated) . The following tradeoffs are involved in the 
identification of bias parameters s 

- Rate of convergence for bias parameter estimates can be 

accelerated by increasing the initial bias uncertainties at 
the expense of large transients. 

- Too large a value for the initial bias uncertainty, 
especially for the input biases, can severely degrade 
estimation performance by producing large bias filter 
gains. A good rule of thumb is to use approximately 3-5 
times the standard deviation of the expected bias level. 

4.2 System Performance - Failures 

In this section, some typical filter-detector simulation runs 
will be presented to analyze the failure detection capability of 
the proposed sensor fault tolerant system. Figures 15-17 show the 
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ultimate failure detection performance of the system. In these 
runs, the baseline EKF (with all sensor biases set to zero) was 
used to drive the detectors. As can be seen from Figures 15 and 
16, the state estimation performance under failures is essentially 
the same as the baseline under no failures with slight expected 
degradation at the failure times. 

In these runs, a sequence of IMU roll, MLS azimuth and 
accelerometer failures are simulated. For the preliminary results, 
only bias failures were considered. First IMU roll measurement is 
failed with a bias jump of 1° at 78 seconds. As seen from the 
first graph in Figure 17, hypothesis 21 (H 2 j^) is selected by the 
decision logic up to 75.15 seconds. Recall (from Table IV) that 
^21 signifies the decision that none of the measurements currently 
used by the no-fail filter have failed. At 78.15 seconds, first 
IMU roll attitude failure is identified by selecting hypothesis 
^11* The faulty sensor (in this case, the entire first IMU) is 
rejected so that the no— fail filter starts using the attitude 
measurements from the second IMU instead of the average of the two 
IMU's. After the removal of the failed instrument, the decision 
logic reverts to correctly selecting Second MLS azimuth 
measurement fails with a bias jump of .4° at 90 seconds. This 
failure is detected at 90.25 seconds as indicated by the selection 
of hypothesis 14. Thus, second MLS azimuth sensor is removed from 
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Figure 16; Attitude Est. Errors - Baseline with Failures 
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Figure 17: Selected Hypothesis and A Posteriori 

Time Histories - Baseline with Failures 
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the measurement set and the decision logic returns to correctly 

selecting H 22 ^. Finally, the first x-accelerometer fails with a 

2 

bias jump of Im/sec at 110 seconds. This failure is detected at 
116.85 seconds as indicated by the selection of At this 
instant, the first x-accelerometer measurement is rejected and 
replaced by the second x-accelerometer in the no-fail filter so 
that the decision logic reverts to correctly selecting ^ 2 ^ after 
the replacement of the faulty sensor. 

Figure 17 also shows the a posteriori probabilities for 
hypotheses ®24'^11' ^21' "^hese probability time histories 
demonstrate that our decision logic is essentially equivalent to 
choosing the hypothesis with the largest posteriori probability. 
For instance, the posteriori probability for corresponding to 
the second IMU roll attitude failure spikes to approximately 0.95 
at 78.15 seconds while the no-fail posteriori probability 
simultaneously decreases to 0.05. 

As can be seen from Figure 17, the detection of output sensor 
failures is much faster than that of input sensor failures. This 
is to be expected since the input sensor failures have to propagate 
through the no-fail filter dynamics in order to get detected. 
Furthermore, soft input failures would naturally take more time for 
detection compared to hard input failures. 
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The transient effects of filter-detector reconfiguration can 
also be seen in Figures 15-16. Notice at 117 seconds when an x 
accelerometer failure is detected, the errors oscillate and are 
driven back to near zero levels very quickly. Since by design, 
failures corrupt the no-fail filter estimates, it is important that 
the filter is able to recover from the integrated effects of these 
failures once they have been detected. 

The next set of Figures, 18-20, show the failure detection 
performance of the sensor fault tolerant system with the normal 
operating bias filter in operation. In these runs, all sensor 
biases are present (see Table I). However, only MLS range and 
accelerometer biases are selected for identification. Again, the 
state estimation performance is similar to the case obtained 
without failures as seen in Figures 18-19. The same sequence of 
IMU roll, MLS azimuth and x-accelerometer failures have been 
simulated. Inclusion of the bias filter does not affect the 
detection of IMU roll and MLS azimuth failures. As can be seen in 
Figure 21, these failures are identified at the same instants as 
before. However, the soft failure in the x-accelerometer did not 
get identified during the course of the simulation. 

As seen in Figure 21, the inclusion of the bias filter does 
increase the false alarm rate due to these phenomena; First, there 
is an interdependence between the normal operating bias filter and 
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Figure 20: Normal Operating Bias Estimates — Failures 
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Figure 21: Selected Hypothesis and A Posteriori 

Probability Time Histories - Failures 
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those detectors for sensors which are selected for normal operating 
bias identification. If the normal operating biases are estimated 
poorly, then the bias estimation error looks like a failure to the 
corresponding detector. Second, the effect of ignoring normal 
operating biases essentially produces a similar effect. These 
issues will be investigated during the second year of the study. 
In our runs, we have used a priori probability of 0.9999 for the 
hypothesis to compensate for the expected degradation in the 
no-fail filter due to sensor biases that are ignored. For 
instance, another possibility is the use of different Bayesian cost 
terms instead of the simple case utilized now. 

Another possible improvement would be the use of the average 
of the replicated input sensors (accelerometers and rate gyros) in 
the no-fail filter, since this would effectively reduce the 
measurement noise and normal operating bias level in the averaged 
measurements. Currently, hardware redundant input sensors are kept 
as standby equipment. However, the current input detectors would 
need to be modified since they could not distinguish a failure 
between like inputs in their present form. 

Figures 22-23 indicate the failure detection performance of 
the sensor fault tolerant system with the RSDIMU body accelerations 
and rates replacing the body mounted accelerometer and rate gyro 
measurements. A sequence of IMU roll attitude, MLS azimuth and IMU 
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Figure 22: Position Est. Errors - Failures with RSDIMU 
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Figure 23. Attitude Est. Errors - Failures with RSDIMU 
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yaw attitude sensor failures are simulated. The roll attitude of 
the first IMU fails with a bias jump of 1° at 78 sec. and is 
quickly identified at 78.15 seconds. The azimuth measurement of 
the second MLS module fails with a bias jump of .4 deg at 90 sec. 
and is identified at 90.25 seconds. The speed of identification is 
the same as the case without the RSDIMU. The yaw attitude failure 
of the second IMU with a bias jump of 1° at 110 sec. is identified 
at 110.3 seconds. 

As expected (see Figure 22) , position estimation performance 
of the no-fail filter is initially significantly better than the 
case in which body mounted accelerometers are employed. This is 
due to the better accuracy of the navigation quality accelerometers 
and rate gyros in the RSDIMU. The ramp type position estimation 
errors (e.g., ramp error starting in the z-position estimation 
error in Figure 22) can be traced to accelerometer impulse type 
errors due to scale factors. 

The failure detection performance (not shown) with colored MLS 
measurement noise was degraded due to false alarms. This is due 
mainly to the fact that any time correlation in the no-fail filter 
residuals looks like a time varying bias jump to the detectors. 
The sensor fault tolerant system design will be modified in the 
second year of the study in order to remove the effects of colored 
MLS noise. The state estimation performance with colored MLS noise 
was essentially the same as the case with white MLS noise. 
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Further tuning of the noise parameters will help to improve 
both the state estimation and failure detection performance. For 
instance, MLS filter noise is not accounted for in the no-fail 
filter. The effect of this error, due to digital scanning, would 
be an effectively higher MLS measurement noise. 
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V. SUMMARY 


In the preceding chapters, an aircraft sensor fault tolerant 
system design methodology has been presented. The design problem 
is formulated in the context of simultaneous state estimation and 
failure detection in discrete time nonlinear stochastic systems. 
The proposed solution involves the implementation of a no-fail 
extended Kalman filter and a bank of first order detectors. The 
no-fail EKF computes estimates for aircraft states and normal 
operating sensor biases on the assumption of no-failures. A new 
separate bias algorithm has been derived for the EKF implementation 
by extending the results for the linear case to nonlinear systems. 
The residuals of the no-fail EKF drive a bank of detectors each of 
which estimate a postulated sensor bias jump failure for a given 
sensor. Multiple hypothesis testing procedure is then employed to 
select the most likely failure mode in the Bayesian sense. When a 
failure is declared, the filter-detector structure is reconfigured 
by deleting the faulty sensor. 

The state estimation and sensor failure detection performance 
of the developed aircraft sensor fault tolerant system has been 
analyzed on the nonlinear six-degree-of-f reedom simulation of the 
TCV research aircraft. In our experience with several runs using 
different bias levels, initial conditions, and initial 
uncertainties, we have found the numerical stability of the no-fail 
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EKF to be as good as the square root algorithm. The overall 
performance of the filter is typical of the EKF applications with 
largest estimation errors occurring during startup and aircraft 
maneuvers. Estimation errors compare favorably to those obtained 
with other types of navigation filters employed in the same 
environment. Sensor failure detection performance of the fault 
tolerant system is excellent for the no-fail EKF output sensors 
such as MLS, IAS, IMU measurements. The failure detection speed 
for input sensors such as body mounted accelerometers and rate 
gyros is slower than that of output sensors. This is to be 
expected since the input sensor failures have to propagate through 
the no-fail filter dynamics in order to get detected. During the 
course of our study we have determined that the following issues 
should be further investigated for possible improvement of failure 
detection performance: 

- Bias Filter /Detector Interaction : As expected, there is an 
interdependence between the normal operating bias filter and those 
detectors for sensors which are selected for normal operating bias 
identification. The selection of sensors for normal operating bias 
identification could presumably be decided for the optimization of 
failure detection performance. 

~ MLS Colored Noise : As discussed in the previous chapter, 
when colored MLS measurement noises are assumed to be white in the 
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filter design, the failure detection performance of the fault 
tolerant system becomes degraded due to false alarms. Various 
possible remedies have already been identified and a suitable 
modification will be incorporated into the design to alleviate this 
problem. 

“ Replicated Input Failure Identification : As proposed, the 
fault tolerant system uses one set of replicated body mounted 
accelerometers and rate gyros as input. The hardware redundant 
input sensors are kept as standby equipment. The possibility of 
using the average of these replicated-input sensors should be 
investigated for better estimation performance. However, the 
current input detectors would need to be modified since they could 
not distinguish a failure between like inputs. 

These issues will be resolved in the second year of the study. 
Furthermore, failure detection performance of the fault tolerant 
system will be analyzed under different type failures. Tests for 
healing of a failed sensor will be included. Robustness of the 
overall system will be analyzed under steady state wind conditions 
and different landing paths. A sensor configuration design method 
will be developed so that a sensor complement with a minimum 
replication of sensors could be selected for a given mission 
reliability. 
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APPENDIX A 


EKF INPUT AND MEASUREMENT PARTI ALS 

This appendix contains the input and measurement partials 
which are needed in the implementation of the no-fail filter of 
Section 2.3. 


Input Partials ; Let u= [aj^,ay,a 2 fP,q, r] ' where 
(Pf^fr) are the input variables associated with the body mounted 
accelerometers and rate gyros. Then, the input partials for the 
EKF will be given by: r. 1 


I. T 
2 GBP 


^ (B(x(k))u) = 

3x 


T 


T 

GBP 


(A.l) 


T 


T 

ERP 


L “ J 

where the matrices T^^p and T^^p are the partials associated with 
the transformations T^g and T^p. The nonzero elements of T^gp are 
defined by 
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= C6s6si|j + S(j)Si|j 
= -ScpsQCjp + C(pSlp 
= -SipSdSlp - C(pCllj 
= -C(psesip + S(pctp 


(A. 2) 
(A. 3) 
(A. 4) 
(A. 5) 
(A. 6) 
(A. 7) 
(A.8) 
(A. 9) 

(A. 10) 
(A.ll) 
(A. 12) 
(A. 13) 
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The nonzero elements of are defined by: 


•• 

Tepp( 1,7) = (c(j)t 0 )q - (s(()te)r 

(A. 14) 

- 

Tepp( 1,8) = (s(()sc^9)q + (c(|)sc^0)r 

(A. 15) 


"" (s4>)q - (C(j))r 

(A. 16) 


Teep( 3,7) = (c4)S0)q - (s4>s0)r 

(A.17) 


Tepp( 3,8) = (S(|)SC0t0)q + (c<()SC0t0)r 

(A. 18) 


Measurement Partials : The nonzero elements of the measurement 

partial H(x(k) = — - are defined by: 


H{1,1) 
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APPENDIX B 


DERIVATION OF THE SEPARATE BIAS EKF ALGORITHM 

In [7], Friedland has shown that the least mean square state 
estimator for a linear dynamic system augmented with bias states 
can be decomposed into three parts: 1) a bias-free state 
estimator; 2) a bias estimator; and 3) a blender. The bias-free 
state estimator is designed on the assumption of zero biases. The 
innovations of this bias-free filter are then used as measurements 
by the bias estimator. Finally, the bias-correction matrix 
computed in the blender is used to blend the bias estimators with 
the bias-free state estimate to obtain the optimum state estimate. 
Even if this new filter structure is not utilized, these results 
provide numerically advantageous decomposition procedures for 
computing the estimator gains for the composite filter 
corresponding to the system state augmented with the bias 
parameters. 

Several extensions [6] -[15] of the separate bias estimation 
algorithm have appeared in the literature since [7] . The extension 
of the separate-bias estimation algorithm to nonlinear systems is, 
naturally, of practical interest and there has been a number of 
efforts [11]-[13] in this area. In [11], nonlinear system dynamics 
with input biases were considered, but the work was limited to 
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linear observations with no measurement biases. The EKF for the 
augmented system was implemented by using the decomposition for the 
prediction error covariance derived in [7] . The authors did not 
take advantage of the decomposition for the composite filter gain, 
which involves lower order matrices. Furthermore, it is not clear 
which estimates are used for linearizations needed in the extended 
Kalman filter. Separate bias estimation results have also been 
applied to bias identification using a second order suboptimal 
filter [12] . This work was concerned with state estimation in 
nonlinear continuous systems with discrete measurements; and, only 
sensor biases were considered. 

The special case in which the bias enters linearly into the 
nonlinear system dynamics and observations was treated in [13] . In 
this study, an algorithm along the lines of the separate-bias 
estimation approach was proposed for the EKF implementation. This 
method required the computation of the bias correction matrix twice 
and thus introduced additional numerical complexity. Furthermore, 
the proposed estimation algorithm is not an equivalent 
implementation of the extended Kalman filter for the composite 
system augmented with the bias states but rather an approximation 
for it. In fact, it is shown in [6] that a separate bias-free 
filter structure is not possible for this class of systems. 
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In [6] , discrete-time nonlinear stochastic systems with biases 
both in inputs and outputs is considered. In this work, the bias 
model includes input biases entering nonlinear ly into the system 
dynamics so that the class of nonlinear systems considered 
encompasses the earlier studies. Friedland's separate-bias 
estimation algorithm is then generalized to the EKF formulation for 
the class of systems considered. It is shown that a separate 
bias-filter structure, in contrast to the linear case, is no longer 
possible. On the other hand, the computations for the extended 
Kalman filter gains can still be performed using a decomposition 
analogous to that of the linear filtering problem. This 
computational procedure for obtaining the filter gains has the 
following advantages over the EKF algorithms for the augmented 
systems: First, numerical accuracy is improved due to the lower 
order matrix operations involved. Secondly, zero a priori 
information about the bias state initial conditions can be handled 
by implementing the information filter form of the bias covariance 
equations while using the standard filtering equations for the 
system state covariance. 

We will now outline the derivation of the separate bias EKF 
algorithm. Expanding the nonlinearities in (2.1) about the 
conditional mean, x (k) =E [x{k) | y (1) , . . .y (k) ] , and the nonlinearity 
in (2.15) about the single stage prediction, x(k+l/k) , and 
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'V 


retaining only the first order terms in the Taylor series 
expansion, we obtain 

x(k+l)=F(J(k) ,u(k))x(k)+Bjj(i(k))b^j(k)+f (k)+w(k) (B.l) 

y(k+l)=H(x(k+l/k) )x(k+l)+b(k+l)+z(k+l)+v(k+l) (B.2) 

where the matrices F and H are defind by eqs. (2.18) -(2.19) and in 
Appendix A and the vectors f(k) and z(k+l) are given by 

f(k)=- 9 b(x)u ^ x(k) + B(x(k) )u(k)+u (B.3) 

x(k),u(k) ^ 

/V /V ^ 

z ( k+1 ) =h ( X ( k+l/k ) -H (x ( k+l/k ) x ( k+l/k ) (B . 4 ) 

An EKF [16] -[17] of order n+p (where n and p are the number of 
states and biases, respectively) could be obtained by applying the 
standard Kalman filtering algorithms to the linear system described 
by (B.l) and (B.2) while treating f(k) as a known input and z(k) as 
a known output. Instead, Friedland's bias decon 5 >osition algorithm 
[7]will be applied to the linear system described by (2.1)-(2.15) , 
while treating f(k) and z(k) as known inputs and outputs. Hence, 
the bias-free state estimate x^(k) , which is the conditional mean, 
x(k) , obtained with B in B.l, D in B.2, and Pj^(O) all set to zero, 
will be given by 

x^(k+l)=F(x(k) ,u(k))x^(k)+f(k) (B.5) 

+Kq ( k+1, X (k+l/k) ) [y(k+l)-H(x(k+l/k) )xQ(k+l/k)-z(k+l)] 
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with the filter gain computed by eqs. (2. 20) -(2. 22) . Note that 
the bias-free filter gain and the prediction error covariance are 

/V 

coinputed using H evaluated at x(k+l/k) and F evaluated at x(k) and 
b(k) as opposed to evaluating them at XQ(k+l/k) and x^(k). This is 
in contrast to the linear case. That is, the bias-free filter gain 
is a function of the total state estimate x^(k) which is given by 

x(k+l)=XQ(k+l)+V(k+l,x(k+l/k) )b(k+l) (B.6) 

where the bias correction matrix V is computed by using eq. (2.23). 
We shall now investigate how the bias-free filter given by 
equations (B.5)— (B.6) can be implemented. Utilizing the facts that 

/\. A. y\ /s 

XQ(k+l/k)=F(x(k) ,u(k) )XQ(k)+f (k) (B.7) 

A* /\ /V 

x(k+l/k)=Ax{k)+B(x(k) )u(k)+Ug (B.8) 

and substituting these expressions into equations (B. 31) -(B.5) 
employing eq. (B.6), and simplifying, we obtain for the bias-free 
filter 

Ai At A>^ A^ Ak A, A A 

x^(k+l)=Ax(k)+B(x(k) )u(k)+Ug-F(x(k) ,u(k) )V(k,x(k/k-l) )b(k) 

At At At 

+K^(k+l,x(k+l/k) ) {y(k+l)-h(x(k+l/k) )+ [H (x(k+l/k) 

A At A A A 

(F(x(k),u(k))V(k,x(k/k-l))+B(x(k) ,k))]b(k)} (B.9) 

From the above, it is clear that the bias-free filter is 

dependent on the bias estimate, whereas it would be independent of 
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it in the linear case. Even when B is not state dependent (the 
class of nonlinear systems considered in [13]), a first order 

/N. As 

expansion about XQ(k+l/k) for h(x(k+l/k) ,k+l) would not result in a 
decoupled bias-free filter. For instance, carrying out the 
indicated expansion would result in the following expression for 
the bias-free filter residual: 

^ ^ As, A*s As 

y(k+l)-h(xQ(k+l/k) + [H{x(k+l/k)-H(xQ(k+l/k) ] [x (k+l/k) -x^ (k+l/k) ] 

(B.IO) 

Therefore, the bias free filter structure of [13] can be obtained 

As A 

only by assuming that H(xQ(k+l/k) =H (x(k+l/k) . That is, the filter 
algorithm proposed in [13] is not an equivalent implementation of 
the composite EKF for the augmented system but rather an 
approximation to it. Furthermore, a nonlinear state transition 
model with linear observations, as explored in [12] , would still 
not result in a decoupled bias-free filter. However, the bias-free 
and bias estimator equations eq. (B.9) and eq. (2.17), can be 
merged together by substituting them in eq. (B.6) and performing 
the necessary algebraic simplifications to get eqs. (2 . 16) - (2. 17) . 
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APPENDIX C 


DERIVATION OF DETECTOR ALGORITHMS 

This appendix contains the derivation of detector algorithms 
as outlined in Section 2.4. The detector equations are derived by 
analyzing the residual sequence of the no-fail filter described by 
eqs. (2.16) -(2.17) under a specific input failure model given by 
eqs. (2. 35) - (2. 36) , or an output failure model given by eqs. 
(2.37) -(2.38) . First, define the state and normal operating bias 
estimation errors of the no-faiL filter for hypothesis byt 


x.(k) = x(k) 

- X. (k) 

(C.l) 

b.(k) = b(k) 

- b. (k) 

(C.2) 


/N 

where x^(k) and b^(k) are the state and bias estimates provided by 
the no-fail filter when hypothesis is true. That is, the 
estimates x^(k) and b^(k) are cori 5 >uted by eqs. (2.16)-(2.17) with 
the input and output sensor models given by eqs. (2. 35) - (2. 36) and 
(2.37)-(2.38) . Expanding the input nonlinearities in eq. (2.35) 
about x^(k) and the output nonlinear ties in eq. (2.37) about 

At. 

x^(k+l/k) and subtracting the no-fail filter equations from these 
expressions, we obtain the following estimation error dynamics for 
the no-fail filter under hypothesis 


C-1 



r. 


I - 


K,H 


K, S 


IK.ft KsML 




"(I- '!'xA 


■x^(k+l)- 

— 

I- 

\(k+l)' 

b^(k+l) 



Kj^(k+1) 


[H(x^ (k+l/k) ) D] 


F^(x^(k) ,u(k)) B(x^(k)) 
0 I . 



{ 

’B^(x^(k) )■ 


■K^(k+1)- 

1 [H (x^ (k+l/k)) D] 

"b. (x^(k) )- 

b^(k) 

+ ^ 

0 


Kj^(k+1) 

^ -9 


0 


. oi 


Li< B in 


+D. 

1 


m. 

1 



FK (k+l)1 

I - 

X 


K^(k+1) 


[H (x^ (k+l/k))D]' 


- 




w(k)' 

0 


\(k+l) 

Kj^(k+1) 


] 


v(k+l) 


a- M.j 


(C.3) 


f(l- K^H) 

[ -K,H 

yN ys 

where (x (k) ,u (k) ) , H(x^(k+l/k) are defined by eqs. 

(2. 41) , (2. 19) , respectively. The filter gains K (k+l,x . (k+l/k) ) 

s\ X 

and Kj^(k+l,Xj^ (k+l/k) ) are defined by eqs. (2.17c), (2.25). Now 

define the variables x^(k) and b^(k) by eq. (C.3) above with set 
to be zero. That is. 


‘x^(k+l)“ 
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Note that all of the above linearizations are made about Xj^(k) 
and x^(k+l/k). The reason for defining x^(k) and b^(k) is to show 
that expression C.4 corresponds to the no-fail filter's computed 
estimation error covariance under hypothesis Subtracting eq. 
(C.4) from (C.3), we get: 


x^(k) 

Lck) 


x^(k)- 

bo(k)_ 


V. (k)“l 

m . 


(C.5) 


where is defined by eq. (C.5). Using the relationship 

above, we obtain for the residual of the no-fail filter under 
hypothesis 


A 

r (k+l)=C^(k+l,x^(k+l/k) )m^+r (k+1) (C.6) 


where r(k+l) is defined by 

M ^ M «# 

r (k+l)=H(Xj^(k+l/k) )XQ{k+l)+DbQ(k+l)+v(k+l) (C.7) 

In the case of output failures, the computed innovations 
statistics of the no-fail filter would be equal to the statistics 
of r(k) defined above. For input sensor failures, the con?)uted 
innovations statistics will be an approximation to the statistics 
of r(k) due to the dependence of in eq. (C.4) on the failure 
level m^^. 
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